ElcomSoft Breaks iPhone iOS4 Encryption

The saying that “nothing is unbreakable” repeated for one more time as forensic experts from ElcomSoft managed to break the hardware encryption Apple introduced with the iOS 4.

As a reminder, with Apple’s iPhone 3GS the company introduced a hardware encryption chip. Following the release of iOS 4, Apple brought Data Protection feature, a 256-bit hardware encryption for all the devices featuring the chip. This is also one of reasons why millions of users complained their iPhone 3GS slowed down to a crawl following the iOS 4 update.

However, that move put a blanket over every iOS 4 powered device and made iDevices as impenetrable to law enforcement agencies and Middle-Eastern governments such as much despised Blackberries. Thus, scenes from fictional forensic TV shows such as CSI, Hawaii 5-0 are just that – fiction.

In order to break Apple’s encryption, ElcomSoft developed a method to decrypt bit-to-bit images, making decrypted images accesable with forensic tools such as FTK or Guidance EnCase. According to Vladimir Katalov from ElcomSoft, you have to have physical access to the device that is being cracked into:

“Decryption is not possible without having access to the actual device because we need to obtain the encryption keys that are stored in (or computed by) the device and are not dumped or stored during typical physical acquisition. In particular, those keys include:

• Keys computed from the unique device key (UID), which is believed to be embedded in the hardware and is not extractable (so-called keys 0×835 and 0x89B);
• User passcode key which is derived from users’ passcode using the unique device key (UID);
• Escrow key(s) which are derived from escrow pairing records using the unique device key (UID);
• Effaceable storage area which stores number of encryption keys.”

Tools for decrypting the iOS 4 filesystem are accessible in two ways: if you belong to the law enforcement, intelligence agencies or forensic organizations you can purchase the Enhanced Forensic Access to All iOS 4-Running Devices (iPhone, iPad, iPod). The toolkit includes ElcomSoft Phone Password Breaker and a set of special tools that enables you to “access much more information compared to what’s available in those backups, including access to passwords and usernames, email messages, and deleted SMS and mail files.”

If you’re not a eglible agency, you can still acquire the updated Phone Password Breaker which enables you to unlock Apple and BlackBerry backups.

Bear in mind that decryption of 256-bit AES encrypted filesystem would take forever if the company wasn’t one of GPU Computing pioneers and utilized CUDA and STREAM APIs to fully utilize the GeForce and Radeon cards. Even though the companies in questin won’t like hearing this, the software works best with consumer-class cards: cores and clockspeed are the king of the hill, and GeForce GTX 590 and Radeon HD 6990 are just “what the doctor ordered” for quick decryption.

Performance-wise, Phone Password Breaker is completely parallel and can use as much GPUs as possible – if you put four dual-GPU cards, you will have eight GPUs available. For example, a 3.2GHz quad-core Core i7 processor will crunch 4,800 passwords per second. Dual-GPU GeForce GTX 590 crunches about 128,000 passwords per second. However, AMD Radeon GPU Architecture is the undisputed champion of password breaking – Radeon HD 6990 will run about 275,000 passwords per second.

Thus, if you’re relying on encrypted devices to break the law, you can simply ask the “man with the badge” what did they use to track you down: AMD’s STREAM or nVidia CUDA. In any case, you were decrypted using tools from the same Russian company.

Original Author: Theo Valich

This news article is part of our Archive, if you are looking for up-to date articles we would recommend a visit to our computer news section on the Bright Side of News frontpage. Additionally, we take great pride in our Home Office section, as well as the best VPN one, so be sure to check them out as well.